Hello everyone!
I am the operator of a somewhat recent exit node with SMTP allowed, and I have found out something worth sharing. Let me know if this is already known. As suggested by the Tor documentation, I set a reverse DNS which makes clear that my exit node belongs to the Tor network (tor-exit-readme.manalyzer.org). This week-end, I started to recieve weird e-mail delivery failure notifications, and even a line from a guy kindly asking me to stop sending him mail.
The thing is, I was actually lucky to recieve all those, and I wouldn't have if I didn't have a catch-all address set for the whole domain. Looking at the source of the rejected e-mails, I found out that someone was forging e-mails which look like they come from my domain:
Received: from tor-exit-readme.manalyzer.org (tor-exit-readme.manalyzer.org [95.130.11.147]) by smtp.craigslist.org (Haraka/2.5.0) with ESMTP id 66DDCADC-FEA4-4D62-8F08-2630AC1E0299.1 envelope-from best_pharmacy5@manalyzer.org; Mon, 18 Aug 2014 13:25:12 -0700 From: Levitra-Shop best_pharmacy5@manalyzer.org To: rkdq8-4339052657@hous.craigslist.org Subject: When It Comes Healthcare, Nothing Beats a Hometown Advantage, Rkdq8-4339052657 .
(I got tons of these, all procedurally generated e-mail addresses.) The thing is, these e-mails don't just seem like they're coming from my domain: they ARE coming from my domain, since the machine sending them has a rDNS which belongs to it. From a mail server's perspective, they're actually very legitimate and probably won't be flagged as spam. I believe that someone is listing all the exit nodes which have a reverse DNS set up, and uses the domain to send out unwanted e-mail. This is a problem for operators for the following reasons: - The reputation of your domain is damaged, and legitimate e-mails sent from it may end up discarded - It strenghtens the idea that mail servers blindly reject everything that comes out of a Tor exit node
The good news is, there is something you can do about it. This is exactly what Sender Policy Framework [1] was created for. Long story short, this is some information you can put in your DNS to indicate which machines are allowed to send e-mails for the domains, and which are not (hint: the exit node should not be listed in there). Here is a sample policy which says that only servers registered as MX in your DNS should send e-mails for the domain :
tor-exit.domain.com. IN TXT "v=spf1 mx -all"
If you need something more specific, I have found a nice wizard [2] which will help greatly. If you run an exit node and have a reverse DNS set up, I highly recommend you take ten minutes to look into this. Please note that this will NOT prevent Tor users from sending e-mail or restrain their freedom in any way; it will only prevent ill-intentioned people from spoofing your domain. I also think that there should be a note in the Tor documentation about this issue (I couldn't find anything regarding this).
I hope this helps!
[1] https://en.wikipedia.org/wiki/Sender_Policy_Framework [2] http://www.spfwizard.net/
-- JusticeRage
JusticeRage:
I also think that there should be a note in the Tor documentation about this issue (I couldn't find anything regarding this).
If you find the right place and can write a small text, I'd be happy to add it. The wiki is also open for contributions.
I added a note about the problem in the wiki! Regarding the documentation, I think there are two places where this problem is worth mentioning:
- Mike Perry's blog entry regarding minimal harassment [1], bullet point #3. - The documentation page regarding manual relay setup [2], step #4, bullet point #9.
For both pages, here is what I would mention: "If you set up a reverse-DNS for your exit node and allow SMTP in your exit policy, you should consider configuring SPF (https://en.wikipedia.org/wiki/Sender_Policy_Framework) for your domain. If you don't, spammers may use your relay to convincingly spoof e-mails originating from your domain."
Possibly adding a link to the original discussion [3] afterwards, if the policy of the documentation allows external references. Let me know if this is clear enough for you. I can also write a page dedicated to this particular problem in the wiki, if you think it's worth it.
[1] https://blog.torproject.org/blog/tips-running-exit-node-minimal-harassment [2] https://www.torproject.org/docs/tor-relay-debian.html.en [3] https://lists.torproject.org/pipermail/tor-relays/2014-August/005168.html
-- JusticeRage
Hey.
Am 19.08.2014 17:51, schrieb JusticeRage:
The good news is, there is something you can do about it. This is exactly what Sender Policy Framework [1] was created for. Long story short, this is some information you can put in your DNS to indicate which machines are allowed to send e-mails for the domains, and which are not (hint: the exit node should not be listed in there).
You should consider adding a DMARC record as well (with the "reject" policy). This is a somewhat more recent standard that allows you to explicitly drop emails which do not have a DKIM signature for your domain and/or fail SPF checks. Most of the "big" email companies seem to respect DMARC now. See http://www.dmarc.org for details.
felix
tor-relays@lists.torproject.org
-
Felix Eckhofer -
JusticeRage -
Lunar